Ransomware remains a persistent threat to small and medium-sized businesses across Southeast Asia, with Kaspersky data showing 3.51 per cent of regional SMBs were targeted in the first quarter of 2026, up from 2.92 per cent in the same period last year.
In Singapore, the proportion of SMBs targeted rose to 0.69 per cent from 0.57 per cent a year earlier. India and Indonesia recorded the sharpest regional increases, climbing from 3.18 per cent to 4.07 per cent and from 2.83 per cent to 4.01 per cent respectively, while Malaysia rose from 2.09 per cent to 2.74 per cent.
Detection figures understate the true scale
Kaspersky said the detection metric captures only the final stage of a ransomware attack, the deployment of an encryption trojan, meaning intrusions intercepted earlier during initial access, reconnaissance or lateral movement go unrecorded. The Philippines, Thailand and Vietnam bucked the regional trend with modest declines, but Kaspersky noted the sustained proportion of SMBs attacked, rather than the modest year-on-year shifts, is the more telling signal of the threat’s persistence.
A fast-rising threat actor
Clop ransomware topped Kaspersky’s Q1 2026 rankings of the most prolific groups, accounting for 14.42 per cent of victims published on dedicated leak sites under review, followed by Qilin at 12.34 per cent. The Gentlemen, a group that emerged only in July 2025, placed third, deploying custom-built reconnaissance tools and reportedly working with Initial Access Brokers to gain entry to victim networks with minimal effort.
“Threat actors are constantly evolving their tactics to outpace current security measures, and SMB owners cannot afford to underestimate the complexity and risk of ransomware threats. A layered cyber protection strategy is hence needed to provide adequate protection from attacks,” said Fedor Sinitsyn, security expert at Kaspersky.
Adrian Hia, Managing Director for Asia Pacific at Kaspersky, said attackers increasingly see SMBs as an entry point into wider supply chains, targeting firms that often lack dedicated cybersecurity teams or comprehensive patch management programmes.
Recommended defences
- Keep software updated across all devices to close vulnerabilities attackers commonly exploit
- Monitor outgoing traffic closely to detect lateral movement and data exfiltration
- Maintain offline backups that intruders cannot tamper with
- Deploy anti-APT and EDR tools for advanced threat detection and remediation
- Build an incident response plan that covers supply chain attacks, including steps to disconnect suppliers quickly
Kaspersky said most modern ransomware operators now use double extortion, encrypting victims’ files while also threatening to leak exfiltrated data, raising the stakes for SMBs that may assume backups alone are sufficient protection.
